> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmagent.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Configure webhooks for event-driven integrations.

# Webhooks

Trigger Agent tasks from external systems via HTTP, or push Agent results to external services.

## Inbound Triggers

External systems (Zapier, n8n, custom scripts) can trigger Agent tasks by sending HTTP requests to the Cron trigger endpoints.

### Webhook Trigger

```bash theme={null}
curl -X POST https://your-myrm-host/api/cron/trigger/webhook/my-path \
  -H "x-webhook-secret: your-secret" \
  -H "Content-Type: application/json" \
  -d '{"message": "Process this data"}'
```

### Event Trigger

```bash theme={null}
curl -X POST https://your-myrm-host/api/cron/trigger/event \
  -H "Content-Type: application/json" \
  -d '{"message": "new_order_placed", "channel": "ecommerce"}'
```

### System Event Trigger

```bash theme={null}
curl -X POST https://your-myrm-host/api/cron/trigger/system-event \
  -H "Content-Type: application/json" \
  -d '{"source": "monitoring", "event_type": "alert", "payload": {"severity": "high"}}'
```

## Outbound Webhooks

Configure outbound webhooks in **Settings > Channels** using the Webhook Channel. Agent results are automatically pushed as structured JSON POST requests to your configured URL.

## Security

### Inbound

Inbound webhook triggers require an `x-webhook-secret` header that must match the secret configured in the Cron job. Requests without a valid secret are rejected with 401.

### Outbound

All outbound webhook requests are protected by multiple security layers:

* **SSRF Protection**: Every outbound HTTP request passes through `secure_request()` with DNS pinning and private network blocking. Webhook URLs pointing to internal IPs (127.0.0.1, 10.x, 192.168.x, etc.) are automatically rejected.
* **HMAC-SHA256 Signatures**: Outbound webhook payloads include an `X-Webhook-Signature` header (`sha256=...`) for receivers to verify request authenticity. Configure a secret per webhook for strongest verification.
* **Redirect Validation**: Outbound requests follow redirects with per-hop SSRF validation — a redirect to an internal address is blocked even if the original URL is public.
* **Exponential Backoff Retry**: Transient failures (5xx, timeouts) are retried with exponential backoff; permanent errors (4xx) fail immediately.

## GitHub Integration

The built-in GitHub Channel provides native webhook integration for PR reviews, issue management, and push event handling.

1. Navigate to **Settings > Integrations > GitHub**
2. Enter your Personal Access Token (PAT)
3. Configure the Webhook Secret
4. GitHub events (PR opened, issues, push) automatically trigger Agent responses with full context

HMAC-SHA256 signature verification ensures only authentic GitHub payloads are processed.

## Setup via GUI

1. Navigate to **Settings > Automation** (Cron)
2. Create a new scheduled task
3. Select "Webhook" as the trigger type
4. Configure the webhook path and secret
5. Bind an Agent to execute when triggered

## Natural Language Setup

You can also configure webhook triggers via conversation:

> "Help me create a webhook trigger that processes incoming data from our payment system"

The Agent will automatically set up the trigger, generate the webhook URL and secret, and guide you through the external system configuration.